forked from MISP/misp-objects
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathdefinition.json
159 lines (159 loc) · 4.01 KB
/
definition.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
{
"attributes": {
"byte-count": {
"description": "Bytes counted in this flow",
"disable_correlation": true,
"misp-attribute": "counter",
"ui-priority": 0
},
"community-id": {
"description": "Community id of the represented flow",
"misp-attribute": "community-id",
"ui-priority": 0
},
"direction": {
"description": "Direction of this flow",
"disable_correlation": true,
"misp-attribute": "text",
"sane_default": [
"Ingress",
"Egress"
],
"ui-priority": 0
},
"dst-as": {
"categories": [
"Network activity",
"External analysis"
],
"description": "Destination AS number for this flow",
"misp-attribute": "AS",
"ui-priority": 0
},
"dst-port": {
"categories": [
"Network activity",
"External analysis"
],
"description": "Destination port of the netflow",
"misp-attribute": "port",
"ui-priority": 1
},
"first-packet-seen": {
"description": "First packet seen in this flow",
"disable_correlation": true,
"misp-attribute": "datetime",
"ui-priority": 1
},
"flow-count": {
"description": "Flows counted in this flow",
"disable_correlation": true,
"misp-attribute": "counter",
"ui-priority": 0
},
"icmp-type": {
"categories": [
"Network activity",
"External analysis"
],
"description": "ICMP type of the flow (if the traffic is ICMP)",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0
},
"ip-dst": {
"categories": [
"Network activity",
"External analysis"
],
"description": "IP address destination of the netflow",
"misp-attribute": "ip-dst",
"ui-priority": 1
},
"ip-protocol-number": {
"description": "IP protocol number of this flow",
"disable_correlation": true,
"misp-attribute": "size-in-bytes",
"ui-priority": 0
},
"ip-src": {
"categories": [
"Network activity",
"External analysis"
],
"description": "IP address source of the netflow",
"misp-attribute": "ip-src",
"ui-priority": 1
},
"ip_version": {
"description": "IP version of this flow",
"disable_correlation": true,
"misp-attribute": "counter",
"ui-priority": 0
},
"last-packet-seen": {
"description": "Last packet seen in this flow",
"disable_correlation": true,
"misp-attribute": "datetime",
"ui-priority": 0
},
"packet-count": {
"description": "Packets counted in this flow",
"disable_correlation": true,
"misp-attribute": "counter",
"ui-priority": 0
},
"protocol": {
"description": "Protocol used for this flow",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0,
"values_list": [
"TCP",
"UDP",
"ICMP",
"IP"
]
},
"src-as": {
"categories": [
"Network activity",
"External analysis"
],
"description": "Source AS number for this flow",
"misp-attribute": "AS",
"ui-priority": 0
},
"src-port": {
"categories": [
"Network activity",
"External analysis"
],
"description": "Source port of the netflow",
"misp-attribute": "port",
"ui-priority": 1
},
"tcp-flags": {
"categories": [
"Network activity",
"External analysis"
],
"description": "TCP flags of the flow",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0
}
},
"description": "Netflow object describes an network object based on the Netflowv5/v9 minimal definition",
"meta-category": "network",
"name": "netflow",
"requiredOneOf": [
"first-packet-seen",
"ip-src",
"ip-dst",
"dst-port",
"community-id"
],
"uuid": "bf148c58-3e7e-414e-8de8-5d96379ca77e",
"version": 2
}